From 63f5837830b7caef88be50badb326a8463f008aa Mon Sep 17 00:00:00 2001 From: sreekovili Date: Thu, 25 Jun 2026 15:51:44 -0400 Subject: [PATCH 1/4] Add kernel pinning and post-driver reboot to accel_drivers role MIG vGPU deployments require a specific kernel version matching the NVIDIA driver and a reboot after driver installation for nvidia-vgpu-mgr to detect MIG instances. These were previously handled by custom OpenStackDataPlaneService CRs outside the role. New features (disabled by default): - kernel.pin: install a pinned kernel, remove old kernels, exclude kernel packages from future dnf updates - reboot.post_driver: reboot after driver install and boot_config, wait for connection, verify nvidia-vgpu-mgr started Co-Authored-By: Claude Opus 4.6 --- roles/edpm_accel_drivers/defaults/main.yml | 9 +++ roles/edpm_accel_drivers/tasks/kernel_pin.yml | 67 +++++++++++++++++++ roles/edpm_accel_drivers/tasks/main.yml | 10 +++ roles/edpm_accel_drivers/tasks/reboot.yml | 20 ++++++ 4 files changed, 106 insertions(+) create mode 100644 roles/edpm_accel_drivers/tasks/kernel_pin.yml create mode 100644 roles/edpm_accel_drivers/tasks/reboot.yml diff --git a/roles/edpm_accel_drivers/defaults/main.yml b/roles/edpm_accel_drivers/defaults/main.yml index 948c0045d..805c5778c 100644 --- a/roles/edpm_accel_drivers/defaults/main.yml +++ b/roles/edpm_accel_drivers/defaults/main.yml @@ -38,6 +38,15 @@ edpm_accel_drivers: url: "" ssl_no_verify: false disable_gpg_check: false + kernel: + pin: false + version: "" + remove_old: true + reboot: + post_driver: false + timeout: 1800 + wait_for_connection_timeout: 900 + verify_vgpu_mgr: true features: nvidia_mig: manage: false diff --git a/roles/edpm_accel_drivers/tasks/kernel_pin.yml b/roles/edpm_accel_drivers/tasks/kernel_pin.yml new file mode 100644 index 000000000..61e5d887b --- /dev/null +++ b/roles/edpm_accel_drivers/tasks/kernel_pin.yml @@ -0,0 +1,67 @@ +--- +- name: Install target kernel packages + become: true + ansible.builtin.dnf: + name: + - "kernel-{{ _edpm_accel_drivers_config.kernel.version }}" + - "kernel-core-{{ _edpm_accel_drivers_config.kernel.version }}" + - "kernel-modules-{{ _edpm_accel_drivers_config.kernel.version }}" + state: present + register: _edpm_accel_drivers_kernel_install + +- name: Set target kernel as default boot kernel + become: true + ansible.builtin.command: + cmd: "grubby --set-default /boot/vmlinuz-{{ _edpm_accel_drivers_config.kernel.version }}.x86_64" + changed_when: true + +- name: Verify default kernel is set correctly + become: true + ansible.builtin.command: + cmd: grubby --default-kernel + register: _edpm_accel_drivers_default_kernel + changed_when: false + failed_when: _edpm_accel_drivers_config.kernel.version not in _edpm_accel_drivers_default_kernel.stdout + +- name: Remove old kernel packages + when: _edpm_accel_drivers_config.kernel.remove_old | bool + block: + - name: Get list of non-target kernel packages + ansible.builtin.shell: + cmd: | + set -o pipefail + rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}\n' \ + 'kernel' 'kernel-core' 'kernel-modules' \ + | grep -v '{{ _edpm_accel_drivers_config.kernel.version }}' || true + executable: /bin/bash + register: _edpm_accel_drivers_old_kernels + become: true + changed_when: false + + - name: Remove old kernel packages + become: true + ansible.builtin.dnf: + name: "{{ _edpm_accel_drivers_old_kernels.stdout_lines }}" + state: absent + when: _edpm_accel_drivers_old_kernels.stdout_lines | length > 0 + + - name: Remove orphaned boot files for non-target kernels + become: true + ansible.builtin.shell: + cmd: | + cd /boot + for file in vmlinuz-* initramfs-* System.map-* config-* symvers-*; do + if [[ -f "$file" || -L "$file" ]] && \ + [[ "$file" != *"{{ _edpm_accel_drivers_config.kernel.version }}"* ]]; then + rm -f "$file" + fi + done + changed_when: true + +- name: Exclude kernel packages from future updates + become: true + ansible.builtin.lineinfile: + path: /etc/dnf/dnf.conf + regexp: '^excludepkgs=' + line: "excludepkgs=kernel,kernel-core,kernel-modules" + create: false diff --git a/roles/edpm_accel_drivers/tasks/main.yml b/roles/edpm_accel_drivers/tasks/main.yml index 6b90e4a0f..7422198f8 100644 --- a/roles/edpm_accel_drivers/tasks/main.yml +++ b/roles/edpm_accel_drivers/tasks/main.yml @@ -9,6 +9,12 @@ - name: Setup configuration and build enabled vendors list ansible.builtin.import_tasks: setup_config.yml +- name: Pin kernel version for driver compatibility + when: + - _edpm_accel_drivers_config.kernel.pin | bool + - _edpm_accel_drivers_config.kernel.version | length > 0 + ansible.builtin.import_tasks: kernel_pin.yml + - name: Install GPU drivers for enabled vendors ansible.builtin.include_tasks: driver_install.yml loop: "{{ _edpm_accel_drivers_enabled_vendors }}" @@ -26,6 +32,10 @@ when: _edpm_accel_drivers_enabled_vendors | length > 0 ansible.builtin.import_tasks: boot_config.yml +- name: Reboot node after driver installation + when: _edpm_accel_drivers_config.reboot.post_driver | bool + ansible.builtin.import_tasks: reboot.yml + - name: Configure MIG partitioning on NVIDIA GPU when: _edpm_accel_drivers_config.features.nvidia_mig.manage | bool ansible.builtin.import_tasks: nvidia_mig_partitioning.yml diff --git a/roles/edpm_accel_drivers/tasks/reboot.yml b/roles/edpm_accel_drivers/tasks/reboot.yml new file mode 100644 index 000000000..fe9af6317 --- /dev/null +++ b/roles/edpm_accel_drivers/tasks/reboot.yml @@ -0,0 +1,20 @@ +--- +- name: Reboot node to load drivers and initialize vGPU manager + become: true + ansible.builtin.reboot: + reboot_timeout: "{{ _edpm_accel_drivers_config.reboot.timeout }}" + +- name: Wait for node to become reachable + ansible.builtin.wait_for_connection: + timeout: "{{ _edpm_accel_drivers_config.reboot.wait_for_connection_timeout }}" + +- name: Verify nvidia-vgpu-mgr service started + when: _edpm_accel_drivers_config.reboot.verify_vgpu_mgr | bool + become: true + ansible.builtin.systemd: + name: nvidia-vgpu-mgr + state: started + register: _edpm_accel_drivers_vgpu_mgr_status + until: _edpm_accel_drivers_vgpu_mgr_status is succeeded + retries: 5 + delay: 10 From 4561dbc5ff05c87ab2a96fe0914630e54824b512 Mon Sep 17 00:00:00 2001 From: sreekovili Date: Thu, 25 Jun 2026 16:10:01 -0400 Subject: [PATCH 2/4] Address review findings: validation, idempotency, and tests - Add kernel version format validation with assert before any destructive operations - Detect architecture dynamically via uname -m instead of hardcoding x86_64 - Fix dnf.conf exclude syntax (exclude= not excludepkgs=) - Add idempotency guard to reboot: skip when running kernel already matches target - Document kernel and reboot config in argument_specs.yml - Add kernel_pin_reboot molecule test scenario Co-Authored-By: Claude Opus 4.6 --- .../meta/argument_specs.yml | 40 ++++++++++ .../molecule/kernel_pin_reboot/converge.yml | 16 ++++ .../molecule/kernel_pin_reboot/molecule.yml | 24 ++++++ .../molecule/kernel_pin_reboot/prepare.yml | 75 +++++++++++++++++++ .../molecule/kernel_pin_reboot/verify.yml | 25 +++++++ roles/edpm_accel_drivers/tasks/kernel_pin.yml | 34 +++++++-- roles/edpm_accel_drivers/tasks/reboot.yml | 23 ++++-- 7 files changed, 226 insertions(+), 11 deletions(-) create mode 100644 roles/edpm_accel_drivers/molecule/kernel_pin_reboot/converge.yml create mode 100644 roles/edpm_accel_drivers/molecule/kernel_pin_reboot/molecule.yml create mode 100644 roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml create mode 100644 roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml diff --git a/roles/edpm_accel_drivers/meta/argument_specs.yml b/roles/edpm_accel_drivers/meta/argument_specs.yml index 4976aa83f..29ba1cf19 100644 --- a/roles/edpm_accel_drivers/meta/argument_specs.yml +++ b/roles/edpm_accel_drivers/meta/argument_specs.yml @@ -170,6 +170,46 @@ argument_specs: type: bool default: false description: Whether to disable GPG check when installing RPM (not recommended for production) + kernel: + type: dict + description: Kernel version pinning configuration for driver compatibility + options: + pin: + type: bool + default: false + description: Whether to pin a specific kernel version before driver installation + version: + type: str + default: "" + description: >- + Target kernel version to install and pin (e.g. 5.14.0-570.26.1.el9_6). + Required when pin is true. + remove_old: + type: bool + default: true + description: Whether to remove non-target kernel packages and orphaned boot files + reboot: + type: dict + description: Post-driver-install reboot configuration + options: + post_driver: + type: bool + default: false + description: >- + Whether to reboot the node after driver installation and boot configuration. + Required for nvidia-vgpu-mgr to detect MIG instances on NVIDIA GPUs. + timeout: + type: int + default: 1800 + description: Maximum seconds to wait for the reboot to complete + wait_for_connection_timeout: + type: int + default: 900 + description: Maximum seconds to wait for the node to become reachable after reboot + verify_vgpu_mgr: + type: bool + default: true + description: Whether to verify nvidia-vgpu-mgr service started after reboot features: type: dict description: GPU-specific feature configurations diff --git a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/converge.yml b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/converge.yml new file mode 100644 index 000000000..9077bc512 --- /dev/null +++ b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/converge.yml @@ -0,0 +1,16 @@ +--- +- name: Converge + hosts: all + roles: + - role: "edpm_accel_drivers" + vars: + edpm_accel_drivers: + kernel: + pin: true + version: "5.14.0-570.26.1.el9_6" + remove_old: true + reboot: + post_driver: true + timeout: 300 + wait_for_connection_timeout: 120 + verify_vgpu_mgr: true diff --git a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/molecule.yml b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/molecule.yml new file mode 100644 index 000000000..c147eb2e1 --- /dev/null +++ b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/molecule.yml @@ -0,0 +1,24 @@ +--- +dependency: + name: galaxy +driver: + name: delegated + options: + managed: false + ansible_connection_options: + ansible_connection: local +platforms: + - name: compute-1 + groups: + - compute +provisioner: + name: ansible +verifier: + name: ansible +scenario: + test_sequence: + - destroy + - create + - prepare + - converge + - verify diff --git a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml new file mode 100644 index 000000000..2f44658d6 --- /dev/null +++ b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml @@ -0,0 +1,75 @@ +--- +- name: Prepare + hosts: all + roles: + - role: ../../../../molecule/common/test_deps + - role: env_data + tasks: + - name: Install mock nvidia-smi + become: true + ansible.builtin.copy: + src: /bin/true + dest: /usr/bin/nvidia-smi + mode: '0755' + force: true + remote_src: true + + - name: Install mock grubby + become: true + ansible.builtin.copy: + content: | + #!/bin/bash + if [[ "$1" == "--set-default" ]]; then + echo "$2" > /tmp/mock-grubby-default + elif [[ "$1" == "--default-kernel" ]]; then + cat /tmp/mock-grubby-default 2>/dev/null || echo "/boot/vmlinuz-5.14.0-570.26.1.el9_6.x86_64" + fi + dest: /usr/bin/grubby + mode: '0755' + force: true + + - name: Install mock uname + become: true + ansible.builtin.copy: + content: | + #!/bin/bash + if [[ "$1" == "-r" ]]; then + echo "5.14.0-570.26.1.el9_6.x86_64" + elif [[ "$1" == "-m" ]]; then + echo "x86_64" + else + /bin/uname "$@" + fi + dest: /usr/local/bin/uname + mode: '0755' + force: true + + - name: Create mock dnf.conf + become: true + ansible.builtin.copy: + content: | + [main] + gpgcheck=1 + installonly_limit=3 + clean_requirements_on_remove=True + best=True + skip_if_unavailable=False + dest: /etc/dnf/dnf.conf + mode: '0644' + force: true + + - name: Ensure /usr/lib/nvidia directory exists + become: true + ansible.builtin.file: + path: /usr/lib/nvidia + state: directory + mode: '0755' + + - name: Install mock sriov-manage + become: true + ansible.builtin.copy: + src: /bin/true + dest: /usr/lib/nvidia/sriov-manage + mode: '0755' + force: true + remote_src: true diff --git a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml new file mode 100644 index 000000000..181c65ac7 --- /dev/null +++ b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml @@ -0,0 +1,25 @@ +--- +- name: Verify + hosts: all + gather_facts: false + tasks: + - name: Read dnf.conf + ansible.builtin.slurp: + src: /etc/dnf/dnf.conf + register: _verify_dnf_conf + + - name: Verify kernel exclude line is present in dnf.conf + ansible.builtin.assert: + that: "'exclude=kernel,kernel-core,kernel-modules' in (_verify_dnf_conf.content | b64decode)" + fail_msg: "dnf.conf does not contain kernel package exclude line" + + - name: Verify grubby default kernel was set + ansible.builtin.command: + cmd: grubby --default-kernel + register: _verify_default_kernel + changed_when: false + + - name: Verify default kernel contains target version + ansible.builtin.assert: + that: "'5.14.0-570.26.1.el9_6' in _verify_default_kernel.stdout" + fail_msg: "Default kernel is '{{ _verify_default_kernel.stdout }}', expected 5.14.0-570.26.1.el9_6" diff --git a/roles/edpm_accel_drivers/tasks/kernel_pin.yml b/roles/edpm_accel_drivers/tasks/kernel_pin.yml index 61e5d887b..758232fee 100644 --- a/roles/edpm_accel_drivers/tasks/kernel_pin.yml +++ b/roles/edpm_accel_drivers/tasks/kernel_pin.yml @@ -1,4 +1,19 @@ --- +- name: Validate kernel version format + ansible.builtin.assert: + that: + - _edpm_accel_drivers_config.kernel.version | length > 10 + - _edpm_accel_drivers_config.kernel.version is regex('^[0-9]+\.[0-9]+\.[0-9]+-') + fail_msg: >- + kernel.version '{{ _edpm_accel_drivers_config.kernel.version }}' + does not look like a valid kernel version (e.g. 5.14.0-570.26.1.el9_6) + +- name: Detect system architecture + ansible.builtin.command: + cmd: uname -m + register: _edpm_accel_drivers_arch + changed_when: false + - name: Install target kernel packages become: true ansible.builtin.dnf: @@ -12,7 +27,9 @@ - name: Set target kernel as default boot kernel become: true ansible.builtin.command: - cmd: "grubby --set-default /boot/vmlinuz-{{ _edpm_accel_drivers_config.kernel.version }}.x86_64" + cmd: >- + grubby --set-default + /boot/vmlinuz-{{ _edpm_accel_drivers_config.kernel.version }}.{{ _edpm_accel_drivers_arch.stdout }} changed_when: true - name: Verify default kernel is set correctly @@ -49,19 +66,26 @@ become: true ansible.builtin.shell: cmd: | + set -o pipefail + target="{{ _edpm_accel_drivers_config.kernel.version }}" cd /boot + removed=0 for file in vmlinuz-* initramfs-* System.map-* config-* symvers-*; do if [[ -f "$file" || -L "$file" ]] && \ - [[ "$file" != *"{{ _edpm_accel_drivers_config.kernel.version }}"* ]]; then + [[ "$file" != *"${target}"* ]]; then rm -f "$file" + removed=$((removed + 1)) fi done - changed_when: true + echo "Removed ${removed} orphaned boot files" + executable: /bin/bash + register: _edpm_accel_drivers_boot_cleanup + changed_when: "'Removed 0' not in _edpm_accel_drivers_boot_cleanup.stdout" - name: Exclude kernel packages from future updates become: true ansible.builtin.lineinfile: path: /etc/dnf/dnf.conf - regexp: '^excludepkgs=' - line: "excludepkgs=kernel,kernel-core,kernel-modules" + regexp: '^exclude=' + line: "exclude=kernel,kernel-core,kernel-modules" create: false diff --git a/roles/edpm_accel_drivers/tasks/reboot.yml b/roles/edpm_accel_drivers/tasks/reboot.yml index fe9af6317..81d8e6f83 100644 --- a/roles/edpm_accel_drivers/tasks/reboot.yml +++ b/roles/edpm_accel_drivers/tasks/reboot.yml @@ -1,12 +1,23 @@ --- +- name: Check if reboot is needed + ansible.builtin.command: + cmd: uname -r + register: _edpm_accel_drivers_running_kernel + changed_when: false + - name: Reboot node to load drivers and initialize vGPU manager - become: true - ansible.builtin.reboot: - reboot_timeout: "{{ _edpm_accel_drivers_config.reboot.timeout }}" + when: >- + not _edpm_accel_drivers_config.kernel.pin | bool or + _edpm_accel_drivers_config.kernel.version not in _edpm_accel_drivers_running_kernel.stdout + block: + - name: Reboot node + become: true + ansible.builtin.reboot: + reboot_timeout: "{{ _edpm_accel_drivers_config.reboot.timeout }}" -- name: Wait for node to become reachable - ansible.builtin.wait_for_connection: - timeout: "{{ _edpm_accel_drivers_config.reboot.wait_for_connection_timeout }}" + - name: Wait for node to become reachable + ansible.builtin.wait_for_connection: + timeout: "{{ _edpm_accel_drivers_config.reboot.wait_for_connection_timeout }}" - name: Verify nvidia-vgpu-mgr service started when: _edpm_accel_drivers_config.reboot.verify_vgpu_mgr | bool From fa14d27116d3da6b4520f3535b67767163223d3d Mon Sep 17 00:00:00 2001 From: sreekovili Date: Fri, 10 Jul 2026 23:41:53 -0400 Subject: [PATCH 3/4] Fix kernel_pin_reboot molecule test for CI environments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The molecule test was failing because: - Hardcoded RHEL kernel version (5.14.0-570.26.1.el9_6) not available in CI repos — dnf install had nothing to do - Mock grubby installed at /usr/bin but real grubby lives at /usr/sbin - No /boot/vmlinuz-* files existed for grubby to operate on - Reboot and nvidia-vgpu-mgr verification impossible in CI Fix by: - Dynamically detecting the installed kernel version in prepare and passing it to converge/verify via a shared file - Installing mock grubby at /usr/sbin with symlink to /usr/bin - Creating fake /boot/vmlinuz-* files for grubby mock - Disabling reboot and vgpu-mgr verification (untestable in CI) Co-Authored-By: Claude Opus 4.6 --- .../molecule/kernel_pin_reboot/converge.yml | 17 +++-- .../molecule/kernel_pin_reboot/prepare.yml | 72 +++++++++++++++---- .../molecule/kernel_pin_reboot/verify.yml | 13 +++- 3 files changed, 80 insertions(+), 22 deletions(-) diff --git a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/converge.yml b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/converge.yml index 9077bc512..c5b3add17 100644 --- a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/converge.yml +++ b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/converge.yml @@ -1,16 +1,23 @@ --- - name: Converge hosts: all + pre_tasks: + - name: Read kernel version saved by prepare + ansible.builtin.slurp: + src: /tmp/test-kernel-version + register: _converge_kernel_version + + - name: Set kernel version fact + ansible.builtin.set_fact: + test_kernel_version: "{{ (_converge_kernel_version.content | b64decode).strip() }}" roles: - role: "edpm_accel_drivers" vars: edpm_accel_drivers: kernel: pin: true - version: "5.14.0-570.26.1.el9_6" + version: "{{ test_kernel_version }}" remove_old: true reboot: - post_driver: true - timeout: 300 - wait_for_connection_timeout: 120 - verify_vgpu_mgr: true + post_driver: false + verify_vgpu_mgr: false diff --git a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml index 2f44658d6..4dfea6489 100644 --- a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml +++ b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml @@ -14,6 +14,55 @@ force: true remote_src: true + - name: Get installed kernel-core version + become: true + ansible.builtin.shell: + cmd: | + set -o pipefail + rpm -q kernel-core --qf '%{VERSION}-%{RELEASE}\n' 2>/dev/null | head -1 || \ + rpm -q kernel --qf '%{VERSION}-%{RELEASE}\n' 2>/dev/null | head -1 || \ + uname -r | sed 's/\.x86_64$//' | sed 's/\.aarch64$//' + executable: /bin/bash + register: _prepare_kernel_version + changed_when: false + + - name: Store kernel version for converge + ansible.builtin.set_fact: + test_kernel_version: "{{ _prepare_kernel_version.stdout }}" + + - name: Save kernel version to file for converge to read + ansible.builtin.copy: + content: "{{ test_kernel_version }}" + dest: /tmp/test-kernel-version + mode: '0644' + + - name: Get system architecture + ansible.builtin.command: + cmd: uname -m + register: _prepare_arch + changed_when: false + + - name: Create /boot directory + become: true + ansible.builtin.file: + path: /boot + state: directory + mode: '0755' + + - name: Create fake vmlinuz for target kernel + become: true + ansible.builtin.file: + path: "/boot/vmlinuz-{{ test_kernel_version }}.{{ _prepare_arch.stdout }}" + state: touch + mode: '0644' + + - name: Create fake vmlinuz for old kernel (to test cleanup) + become: true + ansible.builtin.file: + path: /boot/vmlinuz-4.18.0-old.el9.x86_64 + state: touch + mode: '0644' + - name: Install mock grubby become: true ansible.builtin.copy: @@ -22,26 +71,19 @@ if [[ "$1" == "--set-default" ]]; then echo "$2" > /tmp/mock-grubby-default elif [[ "$1" == "--default-kernel" ]]; then - cat /tmp/mock-grubby-default 2>/dev/null || echo "/boot/vmlinuz-5.14.0-570.26.1.el9_6.x86_64" + cat /tmp/mock-grubby-default 2>/dev/null || echo "none" fi - dest: /usr/bin/grubby + exit 0 + dest: /usr/sbin/grubby mode: '0755' force: true - - name: Install mock uname + - name: Symlink mock grubby to /usr/bin become: true - ansible.builtin.copy: - content: | - #!/bin/bash - if [[ "$1" == "-r" ]]; then - echo "5.14.0-570.26.1.el9_6.x86_64" - elif [[ "$1" == "-m" ]]; then - echo "x86_64" - else - /bin/uname "$@" - fi - dest: /usr/local/bin/uname - mode: '0755' + ansible.builtin.file: + src: /usr/sbin/grubby + dest: /usr/bin/grubby + state: link force: true - name: Create mock dnf.conf diff --git a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml index 181c65ac7..00312780b 100644 --- a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml +++ b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml @@ -3,6 +3,15 @@ hosts: all gather_facts: false tasks: + - name: Read kernel version saved by prepare + ansible.builtin.slurp: + src: /tmp/test-kernel-version + register: _verify_kernel_version_raw + + - name: Set kernel version fact + ansible.builtin.set_fact: + test_kernel_version: "{{ (_verify_kernel_version_raw.content | b64decode).strip() }}" + - name: Read dnf.conf ansible.builtin.slurp: src: /etc/dnf/dnf.conf @@ -21,5 +30,5 @@ - name: Verify default kernel contains target version ansible.builtin.assert: - that: "'5.14.0-570.26.1.el9_6' in _verify_default_kernel.stdout" - fail_msg: "Default kernel is '{{ _verify_default_kernel.stdout }}', expected 5.14.0-570.26.1.el9_6" + that: "test_kernel_version in _verify_default_kernel.stdout" + fail_msg: "Default kernel is '{{ _verify_default_kernel.stdout }}', expected {{ test_kernel_version }}" From 9dae245803bd516c5e0cdf5d0d7cb651178bf5de Mon Sep 17 00:00:00 2001 From: sreekovili Date: Sun, 12 Jul 2026 17:44:00 -0400 Subject: [PATCH 4/4] Fix molecule verify: mock grubby temp file permissions The mock grubby script writes to a temp file via sudo (become: true), which may create the file with restrictive permissions (0600) due to sudo's umask override. The verify phase runs without become and cannot read the file, causing grubby --default-kernel to return "none". Fix by: - Using /var/tmp instead of /tmp (not subject to tmpfiles.d cleanup) - Explicitly chmod 644 the state file after writing - Adding become: true to verify's grubby task to match converge Co-Authored-By: Claude Opus 4.6 --- .../molecule/kernel_pin_reboot/prepare.yml | 5 +++-- .../edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml index 4dfea6489..a35bdf058 100644 --- a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml +++ b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/prepare.yml @@ -69,9 +69,10 @@ content: | #!/bin/bash if [[ "$1" == "--set-default" ]]; then - echo "$2" > /tmp/mock-grubby-default + echo "$2" > /var/tmp/mock-grubby-default + chmod 644 /var/tmp/mock-grubby-default elif [[ "$1" == "--default-kernel" ]]; then - cat /tmp/mock-grubby-default 2>/dev/null || echo "none" + cat /var/tmp/mock-grubby-default 2>/dev/null || echo "none" fi exit 0 dest: /usr/sbin/grubby diff --git a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml index 00312780b..4351fe07e 100644 --- a/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml +++ b/roles/edpm_accel_drivers/molecule/kernel_pin_reboot/verify.yml @@ -23,6 +23,7 @@ fail_msg: "dnf.conf does not contain kernel package exclude line" - name: Verify grubby default kernel was set + become: true ansible.builtin.command: cmd: grubby --default-kernel register: _verify_default_kernel